In the CrowdStrike Falcon platform, policies are applied to groups of hosts, not individual hosts directly. To apply a policy to a specific, pre-defined set of hosts, the correct procedure is to first create a host group using the "Static Assignment" method. This allows you to manually select and add the exact hosts you want in the group. Once the static group is created and saved, you then navigate to the desired prevention policy, go to its "Assigned Host Groups" tab, and associate that newly created group with the policy. This ensures the policy settings are applied exclusively to the hosts you explicitly selected.

B. This describes creating and assigning a dynamic group. While a valid workflow, "Static Assignment" is the direct method for a specific, manually selected list of hosts as implied by the question.

C. This option incorrectly describes the process. The criteria for a dynamic group (OU, OS, etc.) are defined when creating the group, not when assigning the group to a policy.

D. This workflow is incorrect. Policies cannot be assigned directly to individual hosts from the policy assignment tab; they must be assigned to a host group.

1. CrowdStrike Falcon® Platform Documentation

Host groups. This document details the two methods for creating host groups: dynamic and static. The "Static assignment" section explicitly describes the process of manually selecting hosts to form a group. It states

"For static assignment

you can search for and add hosts to the group." This aligns with the first step in option A.

2. CrowdStrike Falcon® Platform Documentation

Prevention Policies. This documentation explains how policies are managed and applied. In the section covering policy assignment

it specifies that policies are enabled for hosts by adding host groups to the policy's "Assigned Host Groups" list. The procedure described is to "Go to Configuration > Prevention Policies... Select a policy... Click the Assigned Host Groups tab... Click Add groups to policy." This confirms the second part of the workflow described in option A.